MOTOR VEHICLE DEALER BOARD

INTERNAL CONTROL QUESTIONNAIRE

REVIEW RESULTS

AS OF

JUNE 2020

Auditor of Public Accounts Martha S. Mavredes, CPA www.apa.virginia.gov

(804) 225-3350

- T A B L E O F C O N T E N T S -

Pages

REVIEW LETTER 1-4

AGENCY RESPONSE 5-6

1 Review Results as of June 2020

August 5, 2020

William Childress, Executive Director Motor Vehicle Dealer Board 2201 West Broad Street, Suite 104 Richmond, Virginia 23220

INTERNAL CONTROL QUESTIONNAIRE REVIEW RESULTS

We have reviewed the Internal Control Questionnaire for the Motor Vehicle Dealer Board (Dealer Board). We completed the review on June 15, 2020. The purpose of this review was to evaluate if the agency has developed adequate internal controls over significant organizational areas and activities and not to express an opinion on the effectiveness of internal controls. Management of the Dealer Board is responsible for establishing and maintaining an effective control environment.

Review Process

During the review, the agency completes an Internal Control Questionnaire that covers significant organizational areas and activities including payroll and human resources; revenues and expenses; procurement and contract management; capital assets; grants management; debt; and information technology and security. The questionnaire focuses on key controls over these areas and activities.

We review the agency responses and supporting documentation to determine the nature, timing, and extent of additional procedures. The nature, timing, and extent of the procedures selected depend on our judgment in assessing the likelihood that the controls may fail to prevent and/or detect events that could prevent the achievement of the control objectives. The procedures performed target risks or business functions deemed significant and involve reviewing internal policies and procedures. Depending on the results of our initial procedures, we may perform additional procedures including reviewing evidence to ascertain that select transactions are executed in accordance with the policies and procedures and conducting inquiries with management. The “Review Procedures” section below details the procedures performed for the Dealer Board. The results of this review will be included within our risk analysis process for the upcoming year in determining which agencies we will audit.

2 Review Results as of June 2020

Review Procedures

The definitive source for internal control in the Commonwealth is the Agency Risk Management and Internal Control Standards (ARMICS) issued by the Department of Accounts (Accounts); therefore, we included a review of ARMICS. The level of ARMICS review performed was based on judgment and the risk assessment at each agency. At some agencies only inquiry was necessary; while others included an in-depth analysis of the quality of the Stage 1 Agency-Level Internal Control Assessment Guide, or Stage 2 Process or Transaction-Level Control Assessment ARMICS processes. Our review of the Dealer Board’s ARMICS program included a review of all current ARMICS documentation and a comparison to statewide guidelines established by Accounts. Further, we evaluated the agency’s process of completing and submitting attachments to Accounts.

We reviewed the Internal Control Questionnaire and supporting documentation detailing policies and procedures. As a result of our review, we performed additional procedures over the following areas: human resources and payroll, revenues, expenses, capital assets, and information systems security. These procedures included validating the existence of certain transactions; observing controls to determine if the controls are designed and implemented; reviewing transactions for compliance with internal and Commonwealth policies and procedures; and conducting further review over management’s risk assessment process.

As a result of these procedures, we noted areas that require management’s attention. These areas are detailed in the “Review Results” section below.

Review Results

We noted the following areas requiring management’s attention resulting from our review:

• The Dealer Board relies on the Department of Motor Vehicles (Motor Vehicles) to performmost of its administrative functions based on a memorandum of understanding (MOU)established between the two agencies. However, the Dealer Board does not maintaindocumented and up-to-date policies and procedures for all critical processes for which theDealer Board is responsible. Additionally, most of the Dealer Board’s existing policies andprocedures do not contain written evidence of management’s review and approval. As Topic20905 and other sections of the Commonwealth Accounting Policies and Procedures (CAPP)Manual state that each agency needs to “publish its own policies and procedures documents,approved in writing by agency management,” the Dealer Board should establish formallydocumented procedures over all critical business processes and ensure evidence ofmanagement’s review and approval is present.

• Motor Vehicles prepares and sends submissions to Accounts disclosing the financial positionand activity of the Dealer Board, but the Dealer Board does not retain evidence of review ofthis information for accuracy and completeness. The State Comptroller’s Directive 1-19states that each institution is responsible for ensuring that submissions provided to Accountsresult in complete and accurate information. As the Dealer Board annually certifies to the

3 Review Results as of June 2020

accuracy and completeness of financial statements or information submitted on its behalf, the Dealer Board should retain documentation of review of these submissions to demonstrate compliance with this requirement.

• The Dealer Board relies on Motor Vehicles’ assessment of internal controls to supportARMICS compliance for those functions outlined in the MOU. However, the MOU does notcontain an expectation of the completion and documentation of ARMICS that Motor Vehicleswill provide. This risks a lack of clarity and potential misunderstanding of the extent ofARMICS testing Motor Vehicles should provide. It is unclear whether Motor Vehicles providesboth stage-1 agency level assessments and stage-2 transaction level control testing or onlyone of these elements of ARMICS. The Dealer Board should clarify this expectation andinclude the details within the MOU.

• Although the Dealer Board was able to provide documentation of Motor Vehicles’ ARMICStesting specific to Motor Vehicles’ processes, the Dealer Board could not providedocumentation of an agency-level risk assessment, assessment of agency-level controls,identification of key controls, or any testing results relating to internal controls over its ownprocesses. As the Dealer Board annually certifies that it has adequately assessed theeffectiveness of its own internal controls and that it has assessed its own agency-level risksas part of ARMICS, the Dealer Board should ensure completion of all requirements of ARMICSand retain documentation as evidence.

• The Dealer Board does not retain documentation of who performs each step of the physicalcounting and recording of inventory. As inventory count sheets were not signed and dated,there is no evidence that an adequate separation of duties between maintaining, counting,and recording of inventory was present. Topic 30515 of the CAPP Manual requires agenciesto ensure the performance of each of these functions by separate individuals. The DealerBoard should modify its inventory process to ensure adequate separation of duties exists andthat proper documentation is available.

• The Dealer Board’s internal process is for the Executive Director to review and approveexpenses. However, only one of four vouchers selected contained evidence of the ExecutiveDirector’s approval prior to sending to Motor Vehicles for processing. The Dealer Boardshould ensure that all expenses have the proper approval in place before sending to MotorVehicles for processing.

• For one selected voucher, Motor Vehicles did not key the invoice into Cardinal until sixmonths after the receipt of services. Further, the vendor was not paid for another twomonths after the invoice date. Section 2.2-4350 of the Code of Virginia requires agencies topromptly pay for delivered goods and services. The Dealer Board should follow up with MotorVehicles on late and unprocessed payments to ensure the receipt of invoices and timelypayments.

4 Review Results as of June 2020

• As outlined in the MOU with Motor Vehicles, the Dealer Board is responsible for reviewingand authorizing the payroll certification that Motor Vehicles performs on behalf of the DealerBoard. This process was updated in the first quarter of 2020 to include copying the ExecutiveDirector on the certification to Accounts. However, during our review, there was no evidencethat the Dealer Board reviewed any payroll information or affirmatively certified to theaccuracy of payroll amounts. The Dealer Board should review payroll information to supportits certification of accuracy and retain evidence of this review.

• The Dealer Board could not provide evidence of the completion of the proper off-boardingprocedures for two selected employees who separated from the agency. The Dealer Boardhas a checklist and system access removal form containing the required steps it must take foreach employee who separates from the agency. However, this checklist does not containclear timelines for completion of each task, nor does it contain blanks for signatures anddates. The Commonwealth’s Information Security Standard, SEC 501, Section PP-4, requiresthe removal of systems access within 24 hours of the employee’s separation. The DealerBoard should revise its checklist and forms for separating employees to include the missingelements and require documented evidence of the completion of each off-boarding task.

• The Dealer Board could not provide evidence to show that a selected employee completedthe required statement of economic interest orientation training. Chapter 31 of the Code ofVirginia requires certain employees occupying positions of trust to complete a trainingrelated to conflicts of interest at least every two calendar years. This same chapter of theCode of Virginia requires agencies to keep a record of attendance to this training. The DealerBoard should maintain evidence of completion of this training as required.

We discussed these matters with management on July 22, 2020. Management’s response to the findings identified in our review is included in the section titled “Agency Response.” We did not validate management’s response and, accordingly, cannot take a position on whether or not it adequately addresses the issues in this report.

This report is intended for the information and use of management. However, it is a public record and its distribution is not limited.

Sincerely,

Martha S. Mavredes Auditor of Public Accounts

JDE\vks

5 Review Results as of June 2020

AGENCY RESPONSE

6 Review Results as of June 2020